Make Leo skill onboarding clean-context reproducible (#150)

* make Leo skill onboarding clean-context reproducible

* harden Leo clean-context skill acceptance

.agents/skills/leo-telegram-canary-ops/SKILL.md

@@ -50,7 +50,7 @@ Name the canary before sending:
 
 ## Message Discipline
 
-Use unique markers such as `WL-LIVE-TG-CORY-YYYYMMDD-Tn`.
+Use unique markers such as `WL-LIVE-TG-M3TAVERSAL-YYYYMMDD-Tn`.
 
 Ask Leo for machine-checkable reply markers like:
 
@@ -74,10 +74,14 @@ After each live Telegram canary:
 
 ## Current Known Proof
 
-- Live memory and KB audit passed for marker `WL-LIVE-TG-CORY-20260709`.
+- Live memory and KB audit are retained in
-- Live staged write passed for `WL-LIVE-TG-CORY-20260709-T3`.
+  `docs/reports/leo-working-state-20260709/telegram-live-canary-current.json`.
-- Readback passed for `WL-LIVE-TG-CORY-20260709-T4`.
+- Live staged-write proof is retained in
-- Open-ended m3taversal-style read-only triage passed for the legacy marker
+  `docs/reports/leo-working-state-20260709/telegram-live-db-write-canary-20260709.json`.
-  `WL-LIVE-TG-CORY-OPEN-20260709`.
+- Open-ended m3taversal-standard read-only triage is retained in
+  `docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-current.md`.
+
+Historical receipts contain immutable legacy marker IDs. Treat them only as
+evidence identifiers; never reuse them as a participant name or future marker.
 
 Use `docs/reports/leo-working-state-20260709/current-truth-index.md` for artifact paths.

.agents/skills/living-ip-kb-interop/SKILL.md

@@ -25,7 +25,7 @@ Prefer deterministic local surfaces before asking an LLM:
 - generated claim indexes from `lib/claim_index.py`;
 - search helpers in `lib/search.py`;
 - copied SQLite state through `teleo-db-operator`;
-- retained proof JSON in `.crabbox-results/` or `proof/`.
+- retained proof JSON at a caller-specified generated-output path.
 
 Read outputs must include file paths, source paths, claim/entity IDs when available, and the exact query used.
 
@@ -80,7 +80,7 @@ If a runtime cannot implement one of these, record the missing tool as a blocker
 
 ## Expected Artifact
 
-Write `.crabbox-results/kb-interop-proof.json` or a caller-specified proof path containing:
+Write `<proof-output>/kb-interop-proof.json` containing:
 
 - runtime name;
 - model/provider if known;

.agents/skills/openclaw-agent/SKILL.md

@@ -28,9 +28,10 @@ Create or update:
 - `AGENTS.md`: scope, repo boundaries, proof requirements;
 - `SOUL.md`: Rio or Theseus identity;
 - `TOOLS.md`: bounded tools only;
-- `skills/decision-engine-refinement/SKILL.md`;
+- `<openclaw-workspace>/skills/decision-engine-refinement/SKILL.md`;
-- `skills/living-ip-kb-interop/SKILL.md`;
+- `<openclaw-workspace>/skills/living-ip-kb-interop/SKILL.md`;
-- `skills/teleo-db-operator/SKILL.md` only for read-only local copies unless explicitly authorized.
+- `<openclaw-workspace>/skills/teleo-db-operator/SKILL.md` only for read-only
+  local copies unless explicitly authorized.
 
 ## Tool Policy
 

.agents/skills/teleo-gcp-parity-ops/SKILL.md

@@ -83,6 +83,22 @@ Do not describe a passing Hermes memory sync as canonical KB parity.
 - Persistent GCP `teleo_canonical` remains the older staging copy measured at
   `52,164` rows and `26` proposals. It has not been promoted or cut over.
 
+## Open Least-Privilege Candidate
+
+PR #148, `Scope GCP Leo runtime to least-privilege Cloud SQL access`, is open as
+of the 2026-07-15 skill-pack reconciliation. It proposes scoped runtime roles,
+secret access, fail-closed Cloud SQL behavior, deployment rollback, and positive
+plus negative permission checks. Those branch files and proposed live outcomes
+are candidate evidence only. Before using them, run:
+
+```bash
+gh pr view 148 --json state,mergedAt,mergeCommit,headRefName,url
+```
+
+Until the PR is merged and its runtime receipt passes, use only paths present on
+canonical `main`, keep persistent GCP classified as staging, do not promote it,
+and do not infer least-privilege cutover from a branch or dry run.
+
 Primary retained proof:
 
 - `docs/reports/leo-working-state-20260709/gcp-db-first-working-leo-20260714.md`

.agents/skills/teleo-infra-provenance/SKILL.md

@@ -26,11 +26,13 @@ Prevent incorrect assumptions about where Leo/Teleo code, runtime state, DB stat
 - Hermes/leoclean runtime profile.
 - Postgres canonical DB.
 - `kb_stage` proposal ledger.
-- Retained proof artifacts under local `outputs/`.
+- Caller-specific external output directories, which are retained evidence but
+  are not repository routes unless copied into the repo evidence pack.
 - Synced report artifacts under the VPS profile report directory.
 
 ## Current Known Path Map
 
+- Canonical code/deployment repository: GitHub `living-ip/teleo-infrastructure`.
 - Repo-local evidence pack: `docs/reports/leo-working-state-20260709/`
 - VPS deploy/source area: `/opt/teleo-eval/workspaces/deploy-infra`
 - VPS deploy stamp: `/opt/teleo-eval/.last-deploy-sha`

.agents/skills/teleo-kb-db-change-workflow/SKILL.md

@@ -44,7 +44,7 @@ Run the deterministic source-to-proposal canary:
 ```bash
 .venv/bin/python scripts/run_leo_local_ingestion_proposal_canary.py \
   --fixture fixtures/working-leo/document-ingestion-v1.json \
-  --output outputs/leo-local-ingestion-proposal-canary-current.json
+  --output /tmp/leo-local-ingestion-proposal-canary-current.json
 ```
 
 Require the source, claim, evidence, and proposal UUIDs to link exactly; claim
@@ -131,7 +131,8 @@ Read:
 
 - `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.json`
 - `docs/reports/leo-working-state-20260709/leo-source-composition-clone-checkpoint-current.json`
-- `outputs/leo-local-ingestion-proposal-canary-current.json`
+- `docs/reports/leo-working-state-20260709/leo-v3-document-source-lifecycle-current.md`
+- `docs/reports/leo-working-state-20260709/source-document-compiler-canary-20260713.md`
 
 ## Claim Ceiling
 

.agents/skills/teleo-leo-onboarding/SKILL.md

@@ -1,13 +1,15 @@
 ---
 name: teleo-leo-onboarding
-description: Use when a worker needs fast context on Teleo/Living IP, Leo, the product architecture, current VPS/GCP split, and the July 9 working-state evidence before doing Leo, Teleo, KB, Telegram, VPS, or GCP work.
+description: Use when a worker needs fast context on Teleo/Living IP, Leo architecture, VPS/GCP and Hermes runtime boundaries, database provenance, ingestion/apply/reconstruction, identity, testing, security, secrets, or incident recovery before doing Leo or Teleo work.
 ---
 
 # Teleo / Leo Onboarding
 
 ## Job
 
-Orient the worker before action. Build a current, proof-linked understanding of the company/product, Leo's role, the infrastructure surfaces, and the exact claim ceiling.
+Orient the worker before action. Build a current, proof-linked understanding of
+the company/product, Leo's role, the infrastructure surfaces, and the exact
+claim ceiling without rediscovering the system from historical chat.
 
 ## Trigger Phrases
 
@@ -17,6 +19,8 @@ Orient the worker before action. Build a current, proof-linked understanding of
 - "Fable handoff for Leo"
 - "before working on Teleo infra"
 - "explain the architecture"
+- "recover or reconstruct Leo"
+- "which skill should I use"
 
 ## Core Model
 
@@ -46,6 +50,52 @@ Orient the worker before action. Build a current, proof-linked understanding of
 - `SOUL.md` is a rendered/runtime artifact. Direct file edits are not canonical
   identity changes without DB row and render/sync proof.
 
+## Clean-Context First Commands
+
+From the repository root, validate the pack without a virtual environment or
+network access:
+
+```bash
+.agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .
+```
+
+Install exactly the manifest-indexed skills into an empty temporary agent skill
+root with:
+
+```bash
+.agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py \
+  --root . \
+  --target /private/tmp/teleo-clean-agent/skills
+```
+
+Installed skills still resolve repository-relative routes against the current
+`teleo-infrastructure` checkout. Keep the agent working directory at the repo
+root. For pytest, use `.venv/bin/python`; if `.venv` is absent, create it from
+`README.md` before running tests. Do not guess a bare `python` command.
+
+Run the deterministic isolated acceptance canary with:
+
+```bash
+.agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py \
+  --root . \
+  --output docs/reports/leo-working-state-20260709/skill-pack-clean-context-canary-current.json
+```
+
+## Task Router
+
+| Area | Skill | Canonical first route |
+|---|---|---|
+| Company, product, architecture | `teleo-leo-onboarding` | `docs/reports/leo-working-state-20260709/current-truth-index.md` |
+| VPS runtime and incidents | `teleo-vps-runtime-ops` | Fresh service, deploy, DB, and cleanup readbacks |
+| GCP and Cloud SQL | `teleo-gcp-parity-ops` | Current main evidence; keep open PR #148 candidate-only |
+| Hermes packaging/runtime | `nousresearch-hermes-agent` | `hermes-agent/` plus the live service-specific ops skill |
+| Database provenance | `teleo-infra-provenance` and `teleo-db-operator` | Separate Git, runtime, SQLite, Postgres, and retained proof |
+| Source ingestion and proposal/apply | `teleo-kb-db-change-workflow` | Hash-bound source, review, guarded apply, receipt |
+| Reconstruction and recovery | `teleo-reconstruction-recovery` | `docs/kb-rebuild-and-recompile.md` |
+| Identity and rendered soul | `working-leo-m3taversal-outcomes` | Canonical identity rows before `SOUL.md` |
+| Testing and proof tiers | `teleo-proof-handoff` | Exact tier, command, receipt, cleanup, claim ceiling |
+| Secrets | `private-password-storage` | Provider login first; never paste or retrieve a secret |
+
 ## Read First
 
 From the repo root, read:
@@ -61,6 +111,7 @@ From the repo root, read:
 9. `.agents/skills/working-leo-m3taversal-outcomes/SKILL.md`
 10. `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.md`
 11. `docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.md`
+12. `docs/kb-rebuild-and-recompile.md`
 
 ## Required Status Split
 
@@ -82,6 +133,9 @@ Do not collapse GCP demo readiness into Telegram completion. Do not collapse pro
 - Do not production-apply DB packets unless explicitly authorized.
 - Do not expose secret contents.
 - Do not treat an old summary as current if a fresh readback is cheap.
+- PRs #146 and #147 are merged repository truth. PR #148 remains an open GCP
+  least-privilege candidate until live `gh pr view 148` readback says otherwise;
+  never route a deployment from its branch as though it were `main`.
 - Use `ssh -o BatchMode=yes teleo-gcp-staging true` to preflight passwordless
   GCP VM access. If the firewall route drifts, rediscover the authenticated
   non-secret route before declaring a blocker. The OIDC/IAP workflow is still

.agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+"""Install the manifest-indexed Leo/Teleo skills into an empty skill root."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+DEFAULT_MANIFEST = Path("docs/reports/leo-working-state-20260709/skill-pack-manifest.json")
+SKILL_NAME = re.compile(r"[a-z0-9-]{1,64}")
+
+
+def _tracked_skill_files(root: Path, skill_dir: Path) -> list[Path]:
+    relative_dir = skill_dir.relative_to(root)
+    result = subprocess.run(
+        ["git", "-C", str(root), "ls-files", "-z", "--", str(relative_dir)],
+        check=False,
+        capture_output=True,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(result.stderr.decode("utf-8", errors="replace"))
+    files = [root / Path(item.decode("utf-8")) for item in result.stdout.split(b"\0") if item]
+    if not files:
+        raise ValueError(f"skill has no tracked files: {relative_dir}")
+    for source in files:
+        if source.is_symlink():
+            raise ValueError(f"skill contains a symlink: {source.relative_to(root)}")
+        if not source.is_file():
+            raise ValueError(f"skill route is not a regular file: {source.relative_to(root)}")
+        source.resolve().relative_to(skill_dir.resolve())
+    return files
+
+
+def install(root: Path, manifest_path: Path, target: Path) -> dict[str, object]:
+    manifest_file = root / manifest_path
+    manifest = json.loads(manifest_file.read_text(encoding="utf-8"))
+    skills = manifest["skills"]
+    if target.exists():
+        raise ValueError(f"target already exists: {target}")
+
+    target.parent.mkdir(parents=True, exist_ok=True)
+    stage = Path(tempfile.mkdtemp(prefix=".teleo-skill-pack-", dir=target.parent))
+    installed: list[str] = []
+    try:
+        for entry in skills:
+            name = entry["name"]
+            if not isinstance(name, str) or SKILL_NAME.fullmatch(name) is None:
+                raise ValueError(f"invalid skill name: {name!r}")
+            expected_path = Path(".agents") / "skills" / name / "SKILL.md"
+            if Path(entry["path"]) != expected_path:
+                raise ValueError(f"skill path must be {expected_path}: {entry['path']!r}")
+            if name in installed:
+                raise ValueError(f"duplicate skill name: {name}")
+
+            source = root / expected_path.parent
+            source.resolve().relative_to((root / ".agents" / "skills").resolve())
+            if not source.is_dir():
+                raise FileNotFoundError(source)
+            destination = stage / name
+            destination.resolve().relative_to(stage.resolve())
+            for tracked_source in _tracked_skill_files(root, source):
+                relative = tracked_source.relative_to(source)
+                tracked_destination = destination / relative
+                tracked_destination.resolve().relative_to(destination.resolve())
+                tracked_destination.parent.mkdir(parents=True, exist_ok=True)
+                shutil.copy2(tracked_source, tracked_destination)
+            installed.append(name)
+        stage.rename(target)
+    except Exception:
+        shutil.rmtree(stage, ignore_errors=True)
+        raise
+
+    return {
+        "artifact": "leo_teleo_skill_pack_install",
+        "status": "pass",
+        "installed_skill_count": len(installed),
+        "installed_skills": installed,
+        "contains_secrets": False,
+        "production_mutation_authorized": False,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=Path.cwd())
+    parser.add_argument("--manifest", type=Path, default=DEFAULT_MANIFEST)
+    parser.add_argument("--target", type=Path, required=True)
+    args = parser.parse_args()
+    try:
+        result = install(args.root.resolve(), args.manifest, args.target.resolve())
+    except Exception as exc:
+        result = {"artifact": "leo_teleo_skill_pack_install", "status": "fail", "error": str(exc)}
+        sys.stdout.write(json.dumps(result, indent=2, sort_keys=True) + "\n")
+        return 1
+    sys.stdout.write(json.dumps(result, indent=2, sort_keys=True) + "\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py

@@ -0,0 +1,172 @@
+#!/usr/bin/env python3
+"""Run the deterministic T2 isolated-install acceptance canary for the skill pack."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+DEFAULT_MANIFEST = Path("docs/reports/leo-working-state-20260709/skill-pack-manifest.json")
+
+SEMANTIC_CONTRACT = {
+    "authority": (
+        "teleo-infra-provenance",
+        "Canonical code/deployment repository: GitHub `living-ip/teleo-infrastructure`.",
+        "GitHub living-ip/teleo-infrastructure",
+    ),
+    "vps_database": (
+        "teleo-leo-onboarding",
+        "VPS canonical KB: Docker Postgres `teleo-pg`, database `teleo`.",
+        "teleo-pg / teleo",
+    ),
+    "gcp_database": (
+        "teleo-leo-onboarding",
+        "GCP canonical KB: private Cloud SQL database `teleo_canonical`.",
+        "private Cloud SQL teleo_canonical; persistent copy remains staging",
+    ),
+    "live_service": (
+        "teleo-infra-provenance",
+        "Live service: `leoclean-gateway.service`",
+        "leoclean-gateway.service",
+    ),
+    "merged_reconstruction": (
+        "teleo-reconstruction-recovery",
+        "PR #146 is merged",
+        "PR #146 merged deterministic genesis-plus-ledger reconstruction",
+    ),
+    "merged_reasoning_verifier": (
+        "teleo-reconstruction-recovery",
+        "PR #147 is merged",
+        "PR #147 merged unseen-reasoning verifier hardening",
+    ),
+    "candidate_only_gcp": (
+        "teleo-reconstruction-recovery",
+        "PR #148 is a separate, open GCP least-privilege candidate",
+        "PR #148 open candidate only; not canonical main",
+    ),
+    "next_safe_action": (
+        "teleo-leo-onboarding",
+        ".agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .",
+        "run the repo-local path validator before any operational action",
+    ),
+}
+
+
+def _run(command: list[str]) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(command, check=False, capture_output=True, text=True)
+
+
+def _contains_contract(text: str, required_text: str) -> bool:
+    """Compare prose semantically across ordinary Markdown line wrapping."""
+
+    return " ".join(required_text.split()) in " ".join(text.split())
+
+
+def run_canary(root: Path, manifest_path: Path) -> dict[str, object]:
+    manifest = json.loads((root / manifest_path).read_text(encoding="utf-8"))
+    installer = root / manifest["installer"]
+    selected_skills = sorted({contract[0] for contract in SEMANTIC_CONTRACT.values()})
+    result: dict[str, object]
+
+    with tempfile.TemporaryDirectory(prefix="teleo-clean-context-") as temporary_text:
+        temporary = Path(temporary_text)
+        installed_root = temporary / "skills"
+        install_process = _run(
+            [str(installer), "--root", str(root), "--manifest", str(manifest_path), "--target", str(installed_root)]
+        )
+        try:
+            install_receipt = json.loads(install_process.stdout)
+        except json.JSONDecodeError:
+            install_receipt = {"status": "fail", "error": install_process.stdout or install_process.stderr}
+
+        semantic_checks: dict[str, bool] = {}
+        answers: dict[str, str] = {}
+        evidence_paths: dict[str, str] = {}
+        for key, (skill_name, required_text, answer) in SEMANTIC_CONTRACT.items():
+            installed_skill = installed_root / skill_name / "SKILL.md"
+            text = installed_skill.read_text(encoding="utf-8") if installed_skill.is_file() else ""
+            semantic_checks[key] = _contains_contract(text, required_text)
+            answers[key] = answer
+            evidence_paths[key] = f".agents/skills/{skill_name}/SKILL.md"
+
+        installed_validator = installed_root / "teleo-leo-onboarding" / "scripts" / "validate_skill_pack.py"
+        validator_process = _run([str(installed_validator), "--root", str(root), "--manifest", str(manifest_path)])
+        try:
+            validator_receipt = json.loads(validator_process.stdout)
+        except json.JSONDecodeError:
+            validator_receipt = {"status": "fail", "error": validator_process.stdout or validator_process.stderr}
+
+        problems: list[dict[str, str]] = []
+        if install_process.returncode != 0 or install_receipt.get("status") != "pass":
+            problems.append({"kind": "install_failed", "detail": str(install_receipt.get("error", "unknown"))})
+        if validator_process.returncode != 0 or validator_receipt.get("status") != "pass":
+            problems.append({"kind": "path_validation_failed", "detail": str(validator_receipt.get("problems", []))})
+        for key, passed in semantic_checks.items():
+            if not passed:
+                problems.append({"kind": "semantic_route_missing", "detail": key})
+
+        passed = not problems
+        result = {
+            "artifact": "leo_teleo_skill_pack_isolated_install_canary",
+            "status": "pass" if passed else "fail",
+            "required_tier": "T2_runtime",
+            "current_tier": "T2_runtime" if passed else "T1_model",
+            "proof_scope": "deterministic_isolated_install_and_route_validation",
+            "fresh_temporary_skill_root": True,
+            "ambient_skill_root_used": False,
+            "agent_reasoning_exercised": False,
+            "installed_skill_count": install_receipt.get("installed_skill_count", 0),
+            "selected_installed_skills": selected_skills,
+            "semantic_checks": semantic_checks,
+            "expected_answers": answers,
+            "evidence_paths": evidence_paths,
+            "canary_command": ".agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .",
+            "canary_exit_status": validator_process.returncode,
+            "canary_receipt": validator_receipt,
+            "missing_to_reach_required_tier": [] if passed else problems,
+            "strongest_claim_allowed": (
+                "T2 deterministic isolated local skill install, route-contract, and path validation only; this artifact "
+                "does not claim an agent reasoning run, and retained product proofs keep their own VPS, GCP-staging, "
+                "isolated-clone, Telegram, and production claim ceilings"
+            ),
+            "contains_secrets": False,
+            "production_mutation_authorized": False,
+            "external_runtime_contacted": False,
+            "problems": problems,
+        }
+
+    result["cleanup_readback"] = {
+        "temporary_skill_root_removed": not Path(temporary_text).exists(),
+        "orphan_processes_started": False,
+    }
+    if not result["cleanup_readback"]["temporary_skill_root_removed"]:
+        result["status"] = "fail"
+        result["current_tier"] = "T1_model"
+        result["problems"].append({"kind": "cleanup_failed", "detail": "temporary skill root remains"})
+    return result
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=Path.cwd())
+    parser.add_argument("--manifest", type=Path, default=DEFAULT_MANIFEST)
+    parser.add_argument("--output", type=Path)
+    args = parser.parse_args()
+
+    root = args.root.resolve()
+    result = run_canary(root, args.manifest)
+    payload = json.dumps(result, indent=2, sort_keys=True) + "\n"
+    if args.output:
+        output = args.output if args.output.is_absolute() else root / args.output
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(payload, encoding="utf-8")
+    sys.stdout.write(payload)
+    return 0 if result["status"] == "pass" else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py

@@ -0,0 +1,248 @@
+#!/usr/bin/env python3
+"""Validate the repo-native Leo/Teleo skill pack and its local routes."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+from pathlib import Path
+
+DEFAULT_MANIFEST = Path("docs/reports/leo-working-state-20260709/skill-pack-manifest.json")
+REPO_PREFIXES = (
+    ".agents/",
+    ".github/",
+    "deploy/",
+    "docs/",
+    "fixtures/",
+    "hermes-agent/",
+    "lib/",
+    "ops/",
+    "outputs/",
+    "schemas/",
+    "scripts/",
+    "systemd/",
+    "tests/",
+)
+PATH_SUFFIXES = (".json", ".jsonl", ".md", ".py", ".sh", ".sql", ".yaml", ".yml")
+CODE_SPAN = re.compile(r"`([^`\n]+)`")
+MARKDOWN_LINK = re.compile(r"\[[^\]]+\]\(([^)]+)\)")
+FENCED_SHELL = re.compile(r"```(?:bash|sh|shell)\n(.*?)```", re.DOTALL)
+
+
+def _frontmatter(text: str) -> dict[str, str]:
+    if not text.startswith("---\n"):
+        return {}
+    try:
+        block = text.split("---\n", 2)[1]
+    except IndexError:
+        return {}
+    values: dict[str, str] = {}
+    for line in block.splitlines():
+        if ":" not in line:
+            continue
+        key, value = line.split(":", 1)
+        values[key.strip()] = value.strip().strip('"')
+    return values
+
+
+def _tracked_paths(root: Path) -> set[Path]:
+    result = subprocess.run(
+        ["git", "-C", str(root), "ls-files", "-z"],
+        check=False,
+        capture_output=True,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(result.stderr.decode("utf-8", errors="replace"))
+    return {Path(item.decode("utf-8")) for item in result.stdout.split(b"\0") if item}
+
+
+def _is_tracked(root: Path, path: Path, tracked: set[Path]) -> bool:
+    relative = path.resolve().relative_to(root.resolve())
+    if path.is_file():
+        return relative in tracked
+    prefix = f"{relative.as_posix().rstrip('/')}/"
+    return any(item.as_posix().startswith(prefix) for item in tracked)
+
+
+def _clean_token(token: str) -> str:
+    token = token.strip().strip("'\"")
+    token = token.rstrip(",;.)]")
+    token = re.sub(r":\d+$", "", token)
+    return token
+
+
+def _candidate_tokens(span: str) -> list[str]:
+    try:
+        tokens = shlex.split(span)
+    except ValueError:
+        tokens = span.split()
+    return [_clean_token(token) for token in tokens]
+
+
+def _resolve_candidate(root: Path, source: Path, token: str) -> Path | None:
+    if not token or token in {".md", ".json", ".py", ".sh", ".sql"}:
+        return None
+    if any(marker in token for marker in ("*", "<", ">", "...", "${", "$LEDGER")):
+        return None
+    if token.startswith(("http://", "https://", "/", "~/")):
+        return None
+    if token.startswith(REPO_PREFIXES) or token in {"README.md", "CODEOWNERS"}:
+        candidate = root / token
+    elif token.endswith(PATH_SUFFIXES) and "/" in token:
+        candidate = source.parent / token
+    else:
+        return None
+    try:
+        candidate.resolve().relative_to(root.resolve())
+    except ValueError:
+        return None
+    return candidate
+
+
+def _inline_paths(root: Path, source: Path) -> set[Path]:
+    text = source.read_text(encoding="utf-8")
+    candidates: set[Path] = set()
+    spans = CODE_SPAN.findall(text) + MARKDOWN_LINK.findall(text)
+    for block in FENCED_SHELL.findall(text):
+        spans.extend(line for line in block.splitlines() if line.strip())
+    for span in spans:
+        for token in _candidate_tokens(span):
+            candidate = _resolve_candidate(root, source, token)
+            if candidate is not None:
+                candidates.add(candidate)
+    return candidates
+
+
+def validate(root: Path, manifest_path: Path) -> dict[str, object]:
+    problems: list[dict[str, str]] = []
+    checked: set[Path] = set()
+    manifest_file = root / manifest_path
+    if not manifest_file.is_file():
+        return {
+            "artifact": "leo_teleo_skill_pack_path_validation",
+            "status": "fail",
+            "problems": [{"kind": "missing_manifest", "path": str(manifest_path)}],
+        }
+
+    manifest = json.loads(manifest_file.read_text(encoding="utf-8"))
+    tracked = _tracked_paths(root)
+    if not _is_tracked(root, manifest_file, tracked):
+        problems.append({"kind": "untracked_manifest", "path": str(manifest_path)})
+    skills = manifest.get("skills", [])
+    skill_names = {entry.get("name") for entry in skills}
+
+    for entry in skills:
+        relative = Path(entry["path"])
+        path = root / relative
+        checked.add(path)
+        if not path.is_file():
+            problems.append({"kind": "missing_skill", "path": str(relative)})
+            continue
+        if not _is_tracked(root, path, tracked):
+            problems.append({"kind": "untracked_skill", "path": str(relative)})
+        metadata = _frontmatter(path.read_text(encoding="utf-8"))
+        if metadata.get("name") != entry.get("name"):
+            problems.append({"kind": "skill_name_mismatch", "path": str(relative)})
+        if not metadata.get("description"):
+            problems.append({"kind": "missing_skill_description", "path": str(relative)})
+        if set(metadata) != {"name", "description"}:
+            problems.append({"kind": "invalid_skill_frontmatter_keys", "path": str(relative)})
+        if not re.fullmatch(r"[a-z0-9-]{1,64}", metadata.get("name", "")):
+            problems.append({"kind": "invalid_skill_name", "path": str(relative)})
+        if relative.parent.name != metadata.get("name"):
+            problems.append({"kind": "skill_folder_name_mismatch", "path": str(relative)})
+
+    required_coverage = manifest.get("required_coverage", {})
+    for area, owners in required_coverage.items():
+        for owner in owners:
+            if owner not in skill_names:
+                problems.append({"kind": "unknown_coverage_owner", "path": f"{area}:{owner}"})
+
+    reference_paths = list(manifest.get("reference_files", []))
+    command_paths = list(manifest.get("command_files", []))
+    scan_paths = list(manifest.get("scan_files", []))
+    for relative_text in reference_paths + command_paths + scan_paths:
+        relative = Path(relative_text)
+        path = root / relative
+        checked.add(path)
+        if not path.is_file():
+            problems.append({"kind": "missing_manifest_path", "path": str(relative)})
+        elif not _is_tracked(root, path, tracked):
+            problems.append({"kind": "untracked_manifest_path", "path": str(relative)})
+
+    for relative_text in manifest.get("executable_files", []):
+        relative = Path(relative_text)
+        path = root / relative
+        checked.add(path)
+        if not path.is_file():
+            problems.append({"kind": "missing_executable", "path": str(relative)})
+        elif not os.access(path, os.X_OK):
+            problems.append({"kind": "not_executable", "path": str(relative)})
+
+    scan_sources = [root / entry["path"] for entry in skills]
+    scan_sources += [root / relative for relative in manifest.get("scan_files", [])]
+    for source in scan_sources:
+        if not source.is_file():
+            continue
+        for candidate in _inline_paths(root, source):
+            checked.add(candidate)
+            if not candidate.exists():
+                problems.append(
+                    {
+                        "kind": "missing_inline_path",
+                        "path": str(candidate.resolve().relative_to(root.resolve())),
+                        "source": str(source.relative_to(root)),
+                    }
+                )
+            elif not _is_tracked(root, candidate, tracked):
+                problems.append(
+                    {
+                        "kind": "untracked_inline_path",
+                        "path": str(candidate.resolve().relative_to(root.resolve())),
+                        "source": str(source.relative_to(root)),
+                    }
+                )
+
+    relative_paths = sorted(str(path.resolve().relative_to(root.resolve())) for path in checked)
+    digest = hashlib.sha256("\n".join(relative_paths).encode("utf-8")).hexdigest()
+    return {
+        "artifact": "leo_teleo_skill_pack_path_validation",
+        "required_tier": "T2_runtime",
+        "status": "pass" if not problems else "fail",
+        "manifest": str(manifest_path),
+        "skill_count": len(skills),
+        "coverage_area_count": len(required_coverage),
+        "checked_path_count": len(relative_paths),
+        "checked_paths_sha256": digest,
+        "contains_secrets": False,
+        "production_mutation_authorized": False,
+        "problems": problems,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=Path.cwd())
+    parser.add_argument("--manifest", type=Path, default=DEFAULT_MANIFEST)
+    parser.add_argument("--output", type=Path)
+    args = parser.parse_args()
+
+    root = args.root.resolve()
+    result = validate(root, args.manifest)
+    payload = json.dumps(result, indent=2, sort_keys=True) + "\n"
+    if args.output:
+        output = args.output if args.output.is_absolute() else root / args.output
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(payload, encoding="utf-8")
+    sys.stdout.write(payload)
+    return 0 if result["status"] == "pass" else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.agents/skills/teleo-reconstruction-recovery/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: teleo-reconstruction-recovery
+description: Use when restoring, rebuilding, recompiling, or incident-recovering Leo's Teleo knowledge database, including snapshot recovery, genesis-plus-ledger replay, source recompilation, parity verification, and honest recovery claim ceilings.
+---
+
+# Teleo Reconstruction Recovery
+
+## Job
+
+Choose the smallest recovery path that restores a usable Leo knowledge system
+without confusing snapshot restoration, strict ledger replay, and semantic
+source recompilation.
+
+## Authority
+
+Read `docs/kb-rebuild-and-recompile.md` first. It is the canonical recovery
+contract. Use `docs/reports/leo-working-state-20260709/current-truth-index.md`
+only for the newest retained proof point, and refresh live state before making a
+current VPS or GCP claim.
+
+PR #146 is merged and owns the deterministic genesis-plus-ledger reconstruction
+slice in `ops/run_local_genesis_ledger_rebuild.py`. PR #147 is merged and owns
+the current unseen-reasoning verifier in
+`scripts/verify_leo_unseen_reasoning_chain.py`. PR #148 is a separate, open GCP
+least-privilege candidate; do not treat its branch files or proposed live state
+as canonical `main` recovery instructions until it merges.
+
+## Select The Recovery Mode
+
+| Need | Path | Honest result |
+|---|---|---|
+| Restore the latest verified state quickly | `ops/run_local_canonical_postgres_rebuild.py` | Exact snapshot recovery |
+| Prove strict post-genesis applies replay exactly | `ops/run_local_genesis_ledger_rebuild.py` | Isolated insert-only ledger replay |
+| Turn one retained source into a reviewed packet | `scripts/compile_kb_source_packet.py` | Deterministic proposal packet, not canonical knowledge |
+| Rebuild every row from original sources | Follow the semantic recompilation contract in `docs/kb-rebuild-and-recompile.md` | Partial until every row and receipt is accounted for |
+| Diagnose a live incident before recovery | Use `.agents/skills/teleo-vps-runtime-ops/SKILL.md` and `.agents/skills/teleo-infra-provenance/SKILL.md` | Fresh read-only incident map |
+
+## Safe Order
+
+1. Identify the intended source database, snapshot, manifest, commit, and hashes.
+2. Keep private dumps, row payloads, source excerpts, and replay material outside
+   the repository and mode `0600`.
+3. Run the selected path in an isolated, network-disabled local container.
+4. Verify schema, constraints, roles, counts, row hashes, key queries, and exact
+   cleanup.
+5. Run the relevant focused tests, then the unseen-reasoning verifier when the
+   restored state is meant to support Leo answers.
+6. Separate local reconstruction from VPS restore, GCP restore, service restart,
+   Telegram delivery, promotion, and production apply. Each is its own proof row.
+
+## Commands
+
+Use the repository virtual environment documented in `README.md`:
+
+```bash
+.venv/bin/python ops/run_local_canonical_postgres_rebuild.py --help
+.venv/bin/python ops/run_local_genesis_ledger_rebuild.py --help
+.venv/bin/python scripts/compile_kb_source_packet.py --help
+.venv/bin/python -m pytest -q \
+  tests/test_run_local_canonical_postgres_rebuild.py \
+  tests/test_run_local_genesis_ledger_rebuild.py \
+  tests/test_verify_leo_unseen_reasoning_chain.py
+```
+
+The help and focused-test commands are safe local canaries. A real recovery
+requires caller-supplied private material and must retain a sanitized receipt
+without the material itself.
+
+## Stop Conditions
+
+Stop before any live restore or restart when the source snapshot is not
+hash-bound, the source authority is ambiguous, parity fails, private material
+would enter Git or logs, cleanup cannot be proved, or the requested operation
+would promote GCP or mutate production without exact authorization.
+
+## Claim Ceiling
+
+- Exact snapshot recovery is working when its parity receipt passes.
+- The merged genesis-plus-ledger path proves an isolated insert-only slice.
+- Semantic source-to-blank-database recompilation remains incomplete until every
+  canonical row traces to a genesis record or reviewed replay receipt.
+- No local receipt proves a live VPS/GCP restore, service restart, Telegram
+  delivery, production apply, or GCP promotion.

.agents/skills/teleo-reconstruction-recovery/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Teleo Reconstruction Recovery"
+  short_description: "Recover and reconstruct Leo knowledge safely"
+  default_prompt: "Use $teleo-reconstruction-recovery to choose and verify the safest Leo database recovery path."

.agents/skills/working-leo-m3taversal-outcomes/SKILL.md

@@ -62,11 +62,16 @@ A working Leo is a Telegram-facing agent that:
 
 ## Current Benchmark Cases
 
-- Marker memory: `WL-LIVE-TG-CORY-20260709`.
+- Historical marker-memory receipt:
+  `docs/reports/leo-working-state-20260709/telegram-live-canary-current.json`.
 - Truth correction: `approved != applied`.
 - Applied canary: proposal `00957f6c-9883-4015-95a4-6b09367efb0e` and edge `c167933e-d513-4f43-9335-d5d8aeb259f2`.
 - Staged write canary: proposal `8dfedb3f-3aa4-4200-970f-4c0016f6869f`, status `pending_review`, with no new public canonical rows after the test timestamp.
-- Open-ended triage canary: `WL-LIVE-TG-CORY-OPEN-20260709`, where Leo inferred the likely failure mode from "agents not working / same state as last night" and explained the proposed, approved, and applied split without exact IDs.
+- Open-ended triage receipt:
+  `docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-current.md`,
+  where Leo inferred the likely failure mode from "agents not working / same
+  state as last night" and explained the proposed, approved, and applied split
+  without exact IDs.
 - Old rich proposal packets: `14fa5ecc...`, `ac036c9d...`, and `a64df080...` are not to be silently production-applied.
 - Guarded apply proof: both generic and real Helmer v3 receipts pass `37/37` in
   disposable PostgreSQL; production Helmer remains unapplied.

README.md

@@ -84,8 +84,8 @@ A mirror sync (every 2 minutes) fast-forwards the PR onto Forgejo, where
 the pipeline picks it up. From there it's the same flow as agent-authored
 PRs — same tiers, same reviewers, same merge rules.
 
-The contributor-facing guide lives in
+The contributor-facing guide is the
-[`teleo-codex/CONTRIBUTING.md`](https://github.com/living-ip/teleo-codex/blob/main/CONTRIBUTING.md).
+[Teleo Codex contributing guide](https://github.com/living-ip/teleo-codex/blob/main/CONTRIBUTING.md).
 
 ## Repository layout
 
@@ -119,10 +119,26 @@ status report in their Pentagon profile.
 ## Development
 
 ```bash
-pip install -e ".[dev]"
+python3 -m venv .venv
-pytest
+.venv/bin/pip install -e ".[dev]"
+.venv/bin/python -m pytest
 ```
 
+## Leo / Teleo Operator Onboarding
+
+Start with the repo-native skill router, not historical chat or a runtime mirror:
+
+```bash
+.agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .
+```
+
+Then read `.agents/skills/teleo-leo-onboarding/SKILL.md` and
+`docs/reports/leo-working-state-20260709/current-truth-index.md`. Recovery work
+starts at `docs/kb-rebuild-and-recompile.md`. GitHub
+`living-ip/teleo-infrastructure` is canonical code/deployment truth; VPS/GCP
+runtime, canonical Postgres, proposal staging, Hermes memory, and retained
+proofs are separate state surfaces.
+
 ## Operations
 
 Production deployment runs on a single VPS. Runbook, restart procedures,

docs/kb-rebuild-and-recompile.md

@@ -25,11 +25,12 @@ Run:
   --output /tmp/teleo-canonical-rebuild-receipt.json
 ```
 
-The newest retained 2026-07-14 post-V3 canary restored a fresh, network-isolated
+The retained 2026-07-14 post-V3 canary restored a fresh, network-isolated
 Postgres and then removed it. The restored target matched the source across all
 39 manifest tables and all 52,167 rows, with no schema, data, constraint, role,
-or performance mismatch. Total runtime was 10.56 seconds, including 2.71
+or performance mismatch. The same source snapshot was subsequently restored to
-seconds for `pg_restore`. Key rows included:
+a disposable private-TLS GCP Cloud SQL clone with exact parity, a bounded
+no-send reasoning turn, and verified cleanup. Key rows included:
 
 - 1,837 claims;
 - 4,145 sources;
@@ -38,9 +39,10 @@ seconds for `pg_restore`. Key rows included:
 - 17 reasoning tools;
 - 29 proposals.
 
-This snapshot includes the completed V3 source canary. It is ready as the
+This snapshot includes the completed V3 source canary. Disposable GCP restore
-current restore input, but it has not yet been restored to GCP; current GCP
+parity is proven at that retained point. Persistent GCP `teleo_canonical`
-parity therefore remains unproven.
+remains the older staging copy, so ongoing parity, promotion, and production
+cutover remain unproven.
 
 This is the fastest disaster-recovery path. It does not require Leo to
 re-extract or relearn the corpus.
@@ -134,7 +136,7 @@ kept all database counts and the proposal payload hash unchanged, left the Leo
 gateway on the same PID with zero restarts, and removed the temporary private
 receipt. The full receipt is deliberately not committed because it can contain
 claim bodies or source excerpts; the sanitized proof is retained as
-`reports/leo-working-state-20260709/kb-apply-replay-receipt-current.json`.
+`docs/reports/leo-working-state-20260709/kb-apply-replay-receipt-current.json`.
 
 Normal applies mark the SQL hash as `exact_executed_sql`. A later
 `--receipt-only` recovery marks it as `reconstructed_current_engine`; it never

docs/reports/leo-working-state-20260709/current-truth-index.md

@@ -2,6 +2,30 @@
 
 Use this file before making status claims. Prefer fresh VPS/GCP readbacks when cheap; this directory is the retained July 9 evidence snapshot committed to the Teleo infrastructure repo.
 
+## Repository And Skill Routing Addendum - 2026-07-15
+
+- PRs #146 and #147 are merged into canonical `main`. The reconstruction source
+  of truth is `docs/kb-rebuild-and-recompile.md`; the merged deterministic paths
+  are `ops/run_local_genesis_ledger_rebuild.py`,
+  `scripts/leo_turn_execution_manifest.py`, and
+  `scripts/verify_leo_unseen_reasoning_chain.py`.
+- PR #148 remains open candidate evidence for least-privilege GCP Cloud SQL
+  runtime access. Do not use its branch-only runbook, deployment script, role
+  migration, or proposed live outcome as canonical `main` until the PR is merged
+  and its retained runtime receipt passes.
+- The repo-native onboarding entry point is
+  `.agents/skills/teleo-leo-onboarding/SKILL.md`. Its standard-library validator
+  is `.agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py`; run it
+  before relying on any skill route from a clean context.
+- The deterministic isolated install/routing/cleanup receipt is
+  `docs/reports/leo-working-state-20260709/skill-pack-clean-context-canary-current.json`.
+- The separate no-history agent onboarding receipt is
+  `docs/reports/leo-working-state-20260709/skill-pack-clean-context-agent-review-current.json`.
+- Exact snapshot restoration is working. The merged genesis-plus-ledger path is
+  an isolated insert-only recovery slice. Full semantic recompilation from every
+  original source remains incomplete. None of these local tiers proves a live
+  VPS/GCP restore, Telegram delivery, production apply, or GCP promotion.
+
 ## GCP Database-First Addendum - 2026-07-14 10:07 UTC
 
 This addendum supersedes the GCP-pending statements in the earlier July 14
@@ -135,8 +159,8 @@ sections below override this newer status.
 - VPS canonical KB: claims `1837`, sources `4145`, evidence `4670`, edges
   `4916`, proposals `26`; proposal states are applied `2`, approved `3`,
   pending review `14`, canceled `7`.
-- VPS direct Cory answers: no-send `DC-01` through `DC-06` strict-score `6/6`.
+- VPS direct m3taversal-standard answers: no-send `DC-01` through `DC-06` strict-score `6/6`.
-- Telegram direct Cory answers: partial. `DC-01` was visibly sent and its live
+- Telegram direct m3taversal-standard answers: partial. `DC-01` was visibly sent and its live
   gateway reply strict-passed server-side, but the reply itself is not yet
   captured in Telegram. `DC-02` through `DC-06` are not yet sent.
 - DB composition/application: deterministic source-to-proposal, full-data clone
@@ -146,7 +170,7 @@ sections below override this newer status.
 - GCP canonical DB: exact VPS parity is proven across `39` tables and `52,164`
   rows over private TLS, with zero row/catalog/role/extension/performance
   mismatches. Gateway PID `148735`, `NRestarts=0` stayed unchanged.
-- GCP Cory replay: six DB-read routes pass. One real no-send model replay
+- GCP m3taversal-standard replay: six DB-read routes pass. One real no-send model replay
   nominally scored `6/6`, but it was rejected because two replies printed false
   zero canonical counts. The harness now enables the required `status` read and
   rejects any printed count that differs from the canonical status receipt. A
@@ -170,16 +194,16 @@ Newest artifacts:
 - `docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json`
 - `docs/reports/leo-working-state-20260709/teleo_clone_cory_20260712t1940z-canonical-parity-receipt.json`
 - `docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-dc01-partial-current.json`
-- `docs/reports/leo-working-state-20260709/gcp-cory-model-replay-current.json` (created only after the hardened rerun)
+- `docs/reports/leo-working-state-20260709/gcp-db-first-blind-claim-current.json`
 - `docs/reports/leo-working-state-20260709/gcp-operator-access-blocker-current.json`
 
 ## Definition And Outcomes
 
 - Working Leo definition: `docs/reports/leo-working-state-20260709/working-leo-definition-20260709.md`
-- Cory expected outcomes: `docs/reports/leo-working-state-20260709/cory-expected-working-leo-outcomes-20260709.md`
+- Legacy-named expected-outcomes evidence: `docs/reports/leo-working-state-20260709/cory-expected-working-leo-outcomes-20260709.md`
 - Current state: `docs/reports/leo-working-state-20260709/working-leo-current-state-20260709.md`
 - Execution plan: `docs/reports/leo-working-state-20260709/working-leo-execution-plan-current.md`
-- Open-ended benchmark spec: `docs/reports/leo-working-state-20260709/working-leo-open-ended-benchmark-spec.json` (5 live-safe open prompts, 9 broader Cory-style outcome scenarios, and 6 no-context direct-claim follow-up prompts for disposable clone/sandbox first)
+- Open-ended benchmark spec: `docs/reports/leo-working-state-20260709/working-leo-open-ended-benchmark-spec.json` (5 live-safe open prompts, 9 broader m3taversal-standard outcome scenarios, and 6 no-context direct-claim follow-up prompts for disposable clone/sandbox first)
 - Open-ended live Telegram canary: `docs/reports/leo-working-state-20260709/telegram-live-open-ended-cory-style-20260709.md`
 - Open-ended live Telegram canary JSON: `docs/reports/leo-working-state-20260709/telegram-live-open-ended-cory-style-20260709.json`
 - Retained Telegram benchmark score for the open-ended canary: `docs/reports/leo-working-state-20260709/telegram-live-open-ended-benchmark-score-current.md`
@@ -187,9 +211,9 @@ Newest artifacts:
 - Full live-safe open-ended Telegram suite report: `docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-current.md`
 - Full live-safe open-ended Telegram suite score: `docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-score-current.md`
 - Full live-safe open-ended Telegram suite score JSON: `docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-score-current.json`
-- Full Cory-style outcome/direct-claim sandbox results: `docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-results-current.md`
+- Full m3taversal-standard outcome/direct-claim sandbox results: `docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-results-current.md`
-- Full Cory-style outcome/direct-claim sandbox score: `docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-score-current.md`
+- Full m3taversal-standard outcome/direct-claim sandbox score: `docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-score-current.md`
-- Full Cory-style outcome sandbox score JSON: `docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-score-current.json`
+- Full m3taversal-standard outcome sandbox score JSON: `docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-score-current.json`
 - Live VPS handler direct-claim suite report: `docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-current.json`
 - Live VPS handler direct-claim suite score: `docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.md`
 - Live VPS handler direct-claim suite review: `docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-review-current.md`
@@ -311,9 +335,9 @@ Newest artifacts:
 
 - Skill-pack map: `docs/reports/leo-working-state-20260709/leo-db-state-13-skill-pack.svg`
 - Helmer packet proof: `docs/reports/leo-working-state-20260709/leo-db-state-14-helmer-packet.svg`
-- Open-ended Cory-style canary map: `docs/reports/leo-working-state-20260709/leo-db-state-15-open-ended-canary.svg`
+- Open-ended m3taversal-standard canary map: `docs/reports/leo-working-state-20260709/leo-db-state-15-open-ended-canary.svg`
 - Helmer ledger packet proof: `docs/reports/leo-working-state-20260709/leo-db-state-16-helmer-ledger.svg`
-- Cory-style outcome benchmark map: `docs/reports/leo-working-state-20260709/leo-db-state-17-cory-outcome-benchmark.svg`
+- m3taversal-standard outcome benchmark map: `docs/reports/leo-working-state-20260709/leo-db-state-17-cory-outcome-benchmark.svg`
 - Leoclean DB versus workspace map: `docs/reports/leo-working-state-20260709/leo-db-state-18-db-vs-workspace.svg`
 - Claim/body/metadata schema map: `docs/reports/leo-working-state-20260709/leo-db-state-19-claims-body-metadata.svg`
 - Cross-surface strategy anchor proof: `docs/reports/leo-working-state-20260709/leo-db-state-20-cross-surface-anchor.svg`
@@ -331,7 +355,7 @@ Newest artifacts:
 
 - VPS Leo Telegram memory, KB audit, and staged-write canaries are live-proven.
 - VPS Leo live-safe open-ended Telegram suite is live-proven and retained-benchmark-scored for `OE-01` through `OE-05`: full selected coverage, `5/5` scored prompts passing, no overclaim, and no marker/staging/canonical KB rows created by the suite.
-- The broader sandbox-first Cory-style benchmark has a full-catalog mixed-evidence score: real retained live Telegram evidence for `OE-01` through `OE-05`, sandbox fixture replies for `CS-01` through `CS-09`, and no-context direct-claim expected-answer/follow-up fixtures for `DC-01` through `DC-06`, `20/20` passing. This is not a live Telegram run for the CS/DC prompts.
+- The broader sandbox-first m3taversal-standard benchmark has a full-catalog mixed-evidence score: real retained live Telegram evidence for `OE-01` through `OE-05`, sandbox fixture replies for `CS-01` through `CS-09`, and no-context direct-claim expected-answer/follow-up fixtures for `DC-01` through `DC-06`, `20/20` passing. This is not a live Telegram run for the CS/DC prompts.
 - After deploy commit `0183a5c805fa3b51d638267afd20f67a1bc3777f`, three fresh VPS GatewayRunner clean-session trials strict-scored `6/6` (`18/18` replies). Every trial posted nothing, made no live profile or production DB change, preserved counts (`1837/4145/4916/4670/26`), removed its temp profile, and left `leoclean-gateway.service` active/running with PID `2403328`, zero restarts, and the same start timestamp. Final cleanup found no matching temp directories.
 - Intentional restart survival is now live-proven as a separate required proof row, not implied by `NRestarts=0`: `systemctl restart leoclean-gateway.service` returned `0`, service moved from `MainPID=1908033` to `MainPID=2845730`, stayed active/running after restart and after the no-post handler smoke, canonical DB counts stayed unchanged (`1837/4145/4670/4916/26`), no Telegram post or production DB apply ran, no live profile change was recorded, temp profile cleanup succeeded, and the post-restart no-post `DC-01` through `DC-06` handler smoke returned six runtime replies. The retained pre-repair post-restart strict score was `5/6`; after deploying repair SHA `090becae1621436467610e529d6328d70964d11f`, the same no-post direct-claim suite strict-scored `6/6` with `DC-01` through `DC-06` all passing, DB counts unchanged, no Telegram post, no production DB apply, no live profile change, and cleanup confirmed. The raw handler JSON is retained on the VPS at `/tmp/leo-post-skill-repair-direct-claim-current.json` with SHA256 `6fffdbafc18913c4fc62feb00906988dee2e696d279f22dd284951a79451f39c`.
 - The Telegram-visible direct-claim benchmark was run in group `Leo` (`-5146042086`): all six prompts and replies are visible, and DB/service state is unchanged. The hardened semantic scorer gives `5/6`; `DC-05` incorrectly suggests applying the strict canary `add_edge` path to one of three legacy approved proposals whose payload types do not all match.
@@ -364,7 +388,7 @@ Newest artifacts:
 - Latest cleanup readback found no leftover rehearsal/clone/staging database names on the VPS Postgres container and did not mutate production DB or post to Telegram.
 - A live Telegram regression canary should be rerun after any production apply; no production apply has been authorized or executed.
 - GCP control-plane Chrome readback now proves project `teleo-501523`, running VM `teleo-prod-1` in `europe-west6-a`, and one available private-only PostgreSQL `16.14` Cloud SQL instance, `teleo-pgvector-standby`, in `europe-west6-c`. Cloud SQL Studio is reachable but exposes no enabled existing IAM database principal and requires built-in password authentication; no credential was submitted and no SQL ran. Database-row/runtime/DC-01-through-DC-06 parity therefore remains unproven. The exact next gate is an already-existing authenticated Studio principal or a separately authorized IAM/database-user enablement window.
-- GCP Console observability now separately proves `teleo-prod-1` is running and that serial output through `2026-07-10T15:57:54Z` contains recurring successful `leoclean-cloudsql-memory-sync.service` cycles. The latest exact `leoclean-gcp-prod-parallel.service` lifecycle event in the retained serial buffer is a Hermes start on July 9 with no later exact stop/failure. Cloud Logging has `92` guest/platform records over seven days but zero matches for `leoclean`, `hermes`, `gateway`, `postgres`, or `teleo-kb`, and Ops Agent is absent. This is bounded unit-activity evidence, not current PID/restart/SHA/profile/model/auth/Telegram/DB-row parity; no-post Cory execution remains unsafe and was not attempted. The agent-created Console tab was closed and no GCP/DB/service/IAM/deploy/credential/Telegram mutation occurred.
+- GCP Console observability now separately proves `teleo-prod-1` is running and that serial output through `2026-07-10T15:57:54Z` contains recurring successful `leoclean-cloudsql-memory-sync.service` cycles. The latest exact `leoclean-gcp-prod-parallel.service` lifecycle event in the retained serial buffer is a Hermes start on July 9 with no later exact stop/failure. Cloud Logging has `92` guest/platform records over seven days but zero matches for `leoclean`, `hermes`, `gateway`, `postgres`, or `teleo-kb`, and Ops Agent is absent. This is bounded unit-activity evidence, not current PID/restart/SHA/profile/model/auth/Telegram/DB-row parity; no-post m3taversal-standard execution remains unsafe and was not attempted. The agent-created Console tab was closed and no GCP/DB/service/IAM/deploy/credential/Telegram mutation occurred.
 - PR #77 auto-deployed to the VPS checkout at merge `1a0abd882d00c1b58fe203f42de42d4eeea61cbf` without restarting Leo: the deploy journal says `No Python changes - services not restarted`, the gateway remained PID `2999690` with `NRestarts=0`, and the apply worker/timer remained disabled and inactive. This proves source synchronization and runtime non-change, not a GCP replay.
 - A passwordless GCP operator is implemented and locally validated but is not yet bootstrapped in project `teleo-501523`. It uses GitHub OIDC/Workload Identity Federation, separate status and clone-operation service accounts, IAP TCP forwarding, OS Login, five-minute SSH keys, and a root-owned dispatcher limited to `status`, `direct-claim-replay`, and `cleanup-clone`. It stores no Google password, local refresh token, service-account JSON key, or API key. One final authenticated GCP admin session is still required to install and verify the IAM/IAP/OS Login/dispatcher path; the old public `/32` rule must remain enabled until the workflow status artifact passes.
 - The broader GCP working-Leo runner now has a complete `20`-prompt catalog and requires `32` GCP-executable non-tautological composition checks plus lifecycle, role-separation, immutable-source, and secret-redaction gates. Local tests and validation-only execution pass, and an independent VPS source baseline is retained with counts `1837/4145/4670/4916/17/26`; live GCP execution remains unproven because the SHA-bound target-identity receipt, four separated database roles/credentials, and passwordless operator bootstrap are not yet present. This does not inherit or claim the VPS-only `34/34` result.

docs/reports/leo-working-state-20260709/fable-leo-teleo-onboarding.md

@@ -1,18 +1,20 @@
 # Fable / Worker Onboarding Prompt - Leo / Teleo
 
-current_canary: read the retained evidence index, then produce a repo/VPS/GCP/Telegram working-state map with exact claim ceilings and next executable action.
+current_canary: validate the repo-native skill routes, then produce a repo/VPS/GCP/Telegram working-state map with exact claim ceilings and next executable action.
 
 Use the Teleo repo skill pack at:
 
 `.agents/skills/`
 
-Load these draft skills first:
+Run `.agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .`,
+then load these manifest-indexed skills first:
 
-1. `skills/teleo-leo-onboarding/SKILL.md`
+1. `.agents/skills/teleo-leo-onboarding/SKILL.md`
-2. `skills/working-leo-m3taversal-outcomes/SKILL.md`
+2. `.agents/skills/working-leo-m3taversal-outcomes/SKILL.md`
-3. `skills/teleo-kb-db-change-workflow/SKILL.md`
+3. `.agents/skills/teleo-kb-db-change-workflow/SKILL.md`
-4. `skills/teleo-vps-runtime-ops/SKILL.md`
+4. `.agents/skills/teleo-reconstruction-recovery/SKILL.md`
-5. `skills/teleo-proof-handoff/SKILL.md`
+5. `.agents/skills/teleo-vps-runtime-ops/SKILL.md`
+6. `.agents/skills/teleo-proof-handoff/SKILL.md`
 
 Hard constraints:
 

docs/reports/leo-working-state-20260709/leo-architecture-work-and-outcomes-20260714.md

@@ -1,6 +1,7 @@
 # Leo Architecture, Work, And Outcomes
 
-Current as of `2026-07-14 01:40 UTC`.
+Original delivery summary from `2026-07-14 01:40 UTC`, reconciled with merged
+repository truth on 2026-07-15.
 
 This is the executive summary of what Leo is, how its knowledge system works,
 what changed during the July 10-14 delivery wave, what is genuinely working,
@@ -17,10 +18,16 @@ managed gateway restart. The current broad no-post suite passes `15/15`.
 
 **The whole system is not complete.** The current broad suite has not yet been
 repeated visibly in the real Telegram group through authenticated Google Chrome.
-The newest post-V3 database copy has not yet been restored and replayed on GCP.
+The newest post-V3 database copy has since been restored to a disposable private
-No V3 production proposal has been canonically applied. A snapshot can rebuild
+GCP Cloud SQL clone with exact parity and a bounded no-send reasoning replay,
-the current database exactly, but the entire historical database cannot yet be
+then cleaned up. Persistent GCP remains staging and older than that disposable
-recompiled from raw documents and review history alone.
+proof point. No V3 production proposal has been canonically applied. A snapshot
+can rebuild the current database exactly, and merged PR #146 adds an exact
+insert-only genesis-plus-ledger slice; the entire historical database still
+cannot be recompiled from raw documents and review history alone.
+
+Repository reconciliation: PRs #146 and #147 are merged `main` truth. PR #148
+remains an open least-privilege GCP candidate and is not canonical runtime proof.
 
 ## The Architecture
 
@@ -255,7 +262,8 @@ left the gateway unchanged, and removed the private receipt afterward.
 | Grounded proposal staging | live VPS `pending_review` row | Achieved |
 | Exact snapshot rebuild | isolated local Postgres, `52,167` rows | Achieved |
 | New strict-apply row receipt | deployed VPS read-only recovery | Achieved |
-| Prior GCP database copy and six-question replay | private Cloud SQL and GCP compute | Achieved at the earlier `52,164`-row proof point |
+| Current disposable GCP copy and ID-free replay | private Cloud SQL and GCP compute, `52,167/52,167` rows | Achieved and cleaned up |
+| Genesis plus strict insert-only replay | isolated local Postgres through merged PR #146 | Achieved for supported strict contracts |
 
 ## What Is Not Achieved
 
@@ -263,9 +271,9 @@ left the gateway unchanged, and removed the private receipt afterward.
 | --- | --- |
 | Current broad Telegram-visible proof | Telegram Web in the connected Google Chrome is not authenticated; handler proof is not visible-chat proof |
 | V3 production canonical apply | proposal remains `pending_review`; no review or apply was authorized |
-| Current GCP parity | the `52,167`-row post-V3 snapshot has not yet been restored and replayed on GCP |
 | Arbitrary automatic document/post/tweet intake | the current source command handles one bounded text-like artifact; general fetch/extract/stage automation is not complete |
-| Full source-to-blank-DB recompilation | historical provenance gaps remain and the genesis-plus-ledger replay runner is not finished |
+| Persistent GCP parity and promotion | the disposable `52,167`-row proof passed, but persistent `teleo_canonical` remains the older staging copy and is not cut over |
+| Full source-to-blank-DB recompilation | historical provenance gaps and unsupported mutating contracts remain beyond the merged insert-only genesis-plus-ledger slice |
 | General DB-to-identity rendering | no complete scheduled DB-to-`SOUL.md` renderer is proven |
 | Deployed decision matrix | matrix tables and voting flow are absent from the current live schema |
 
@@ -282,13 +290,13 @@ left the gateway unchanged, and removed the private receipt afterward.
 
 ## How This Moves GCP Forward
 
-- The prior GCP vertical slice proved the architecture can run against private
+- The current post-V3 snapshot has been restored to a disposable private Cloud
-  Cloud SQL and real GCP compute.
+  SQL clone with exact parity, bounded no-send replay, and cleanup.
-- The current post-V3 dump and manifest are already captured and locally
+- Persistent `teleo_canonical` remains the older staging copy; promotion,
-  verified, so GCP work starts from a known input rather than rebuilding one.
+  continuous replication, Telegram delivery, and production cutover are
-- The same `15/15` suite and exact V3 question are ready for replay.
+  separate decisions and proof rows.
-- The remaining GCP work is operational: authenticate, restore the current copy,
+- Open PR #148 proposes least-privilege runtime access. Its branch and proposed
-  verify parity/private connectivity/performance, replay, and clean up.
+  live end state remain candidate evidence until merge and receipt verification.
 
 ## How This Moves On-Demand Rebuild Forward
 
@@ -311,10 +319,11 @@ verified post-V3 snapshot = genesis epoch
 -> broad answer benchmark
 ```
 
-The new receipt path closes the future side of this model. The next repo-owned
+The new receipt path closes the future side of this model. Merged PR #146 now
-step is to replay one reviewed `approve_claim` receipt onto a clean genesis clone
+replays supported strict insert-only receipts on a clean genesis clone and proves
-and prove exact post-apply parity. Historical import gaps can then be repaired
+exact post-apply parity. The next reconstruction work is to retain complete
-without allowing new gaps to accumulate.
+deltas for mutating contracts, handle or reject legacy freeform applies, and
+repair historical import gaps without allowing new gaps to accumulate.
 
 ## Delivery Chain
 
@@ -333,16 +342,21 @@ The latest coherent delivery sequence is merged:
 | `#135` | current post-V3 snapshot and exact rebuild proof |
 | `#136` | private replay receipts for guarded applies |
 | `#137` | deployed receipt runtime proof |
+| `#144` | GCP database-first restore, fail-closed helper, and live restart proof |
+| `#146` | unified turn manifest and deterministic genesis-plus-ledger replay |
+| `#147` | unseen-reasoning verifier hardened for valid reasoning variance |
+
+PR #148 is open candidate work and is intentionally excluded from the merged
+delivery chain above.
 
 ## Immediate Next Outcomes
 
 1. Authenticate Telegram Web in the connected Google Chrome and run visible,
    out-of-sample m3taversal-style questions.
-2. Authenticate Google Cloud CLI through the connected Chrome flow, restore the
+2. Review and merge or reject PR #148, then verify the least-privilege runtime
-   current post-V3 snapshot to disposable GCP staging, verify parity, replay the
+   receipt before considering any persistent GCP promotion.
-   broad suite, and remove temporary resources.
+3. Extend genesis-plus-receipt reconstruction beyond supported insert-only
-3. Complete the genesis-plus-receipt replayer for `approve_claim` bundles and
+   contracts while retaining exact before/after deltas.
-   prove exact clone-to-replay parity.
 4. Run one explicitly reviewed source packet through guarded apply in a
    disposable clone before seeking any production apply authorization.
 5. Reconstruct the remaining historical source, evidence, and edge provenance.
@@ -363,7 +377,8 @@ The latest coherent delivery sequence is merged:
 
 The last three days produced a stable, testable, database-grounded Leo on the
 VPS at the handler tier, a real source-to-review path, exact snapshot recovery,
-and durable replay evidence for future strict applies. They did not complete
+and durable replay evidence for future strict applies. Subsequent work added
-current Telegram-visible broad proof, current GCP parity, a V3 production apply,
+disposable current GCP parity plus no-send replay and an exact insert-only
-general automatic source ingestion, or full historical source-derived database
+genesis-plus-ledger slice. The system still lacks current Telegram-visible broad
-recompilation.
+proof, persistent GCP parity/promotion, a V3 production apply, general automatic
+source ingestion, and full historical source-derived database recompilation.

docs/reports/leo-working-state-20260709/operator-surface-map.md

@@ -32,10 +32,19 @@ Always refresh before claiming current state.
 ## GCP
 
 - Project: `teleo-501523`
-- Expected active account for project access: `billy@livingip.xyz`
+- Compute: `teleo-prod-1` in `europe-west6-a`.
-- Current retained probe: local gcloud config still selects `billy@livingip.xyz` and `teleo-501523`, but this runner cannot resolve `oauth2.googleapis.com`, so parity is blocked before token refresh/project access can be rechecked.
+- Private Cloud SQL: `teleo-pgvector-standby`, database `teleo_canonical`.
-- Current artifact: `docs/reports/leo-working-state-20260709/gcp-db-parity-current-probe-current.json`
+- Direct passwordless alias `ssh teleo-gcp-staging` and `sudo -n` were retained as
-- Prior auth-capable artifact: `outputs/gcp-db-parity-current-blocker-20260709.json`
+  working on 2026-07-14; always re-run the batch-mode preflight before relying on
+  them.
+- A disposable private-TLS clone matched the current VPS snapshot at `39` tables
+  and `52,167` rows, then was deleted. Persistent `teleo_canonical` remains the
+  older staging copy and is not promoted or cut over.
+- Current artifacts:
+  `docs/reports/leo-working-state-20260709/gcp-db-first-working-leo-20260714.md`
+  and `docs/reports/leo-working-state-20260709/gcp-db-first-parity-current.json`.
+- PR #148 is open candidate evidence for scoped runtime access; its branch and
+  proposed live outcome are not canonical `main`.
 
 ## Telegram
 

docs/reports/leo-working-state-20260709/skill-pack-clean-context-agent-review-current.json

@@ -0,0 +1,106 @@
+{
+  "artifact": "leo_teleo_skill_pack_fresh_agent_review",
+  "status": "pass",
+  "required_tier": "T2_runtime",
+  "current_tier": "T2_runtime",
+  "proof_scope": "fresh_context_agent_onboarding_and_stale_claim_rejection",
+  "evidence_origin": {
+    "agent": "/root/fresh_skill_canary",
+    "fork_turns": "none",
+    "onboarding_authority": "isolated installed skill pack only",
+    "memory_used": false
+  },
+  "answers": {
+    "canonical_code_deployment_repository_authority": {
+      "repository": "GitHub living-ip/teleo-infrastructure",
+      "canonical_branch": "main",
+      "vps_deploy_source_mirror": "/opt/teleo-eval/workspaces/deploy-infra",
+      "mirror_is_canonical_authority": false
+    },
+    "vps_canonical_database": {
+      "container": "teleo-pg",
+      "database": "teleo"
+    },
+    "live_vps_gateway_service": "leoclean-gateway.service",
+    "persistent_gcp_database": {
+      "instance": "teleo-pgvector-standby",
+      "database": "teleo_canonical",
+      "status": "older staging copy",
+      "retained_measurement": {
+        "tables": 39,
+        "rows": 52164,
+        "proposals": 26
+      },
+      "promoted": false,
+      "cut_over": false
+    },
+    "pull_requests": {
+      "146": "merged into canonical main",
+      "147": "merged into canonical main",
+      "148": "open least-privilege GCP candidate; not canonical main"
+    },
+    "approved_proposals_equal_applied_proposals": {
+      "equal": false,
+      "retained_vps_proposal_counts": {
+        "total": 29,
+        "applied": 2,
+        "approved": 3,
+        "pending_review": 16,
+        "canceled": 8
+      },
+      "meaning": "Approved proposals remain staged until canonical application and row-level proof."
+    },
+    "first_safe_local_validation_command": ".agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root ."
+  },
+  "stale_claims_rejected": {
+    "pr_148_is_merged": true,
+    "persistent_gcp_is_promoted": true,
+    "all_approved_proposals_are_applied": true
+  },
+  "validator": {
+    "command": "/private/tmp/teleo-clean-agent-final-20260715/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root /private/tmp/teleo-fleet-20260715/skills-docs-onboarding",
+    "exit_code": 0,
+    "status": "pass",
+    "checked_path_count": 233,
+    "checked_paths_sha256": "ae919c3e7d8cef19a1782a00c640eeeb66c49dfbce3ad9ceaf30eb96e77bda16",
+    "coverage_area_count": 13,
+    "skill_count": 16,
+    "production_mutation_authorized": false,
+    "contains_secrets": false,
+    "problems": []
+  },
+  "repository_readback": {
+    "status_before": [
+      " M .agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py",
+      " M .agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py",
+      " M tests/test_repo_skill_pack.py",
+      "?? goal.md"
+    ],
+    "status_after": [
+      " M .agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py",
+      " M .agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py",
+      " M tests/test_repo_skill_pack.py",
+      "?? goal.md"
+    ],
+    "unchanged": true
+  },
+  "files_read": [
+    ".agents/skills/teleo-leo-onboarding/SKILL.md",
+    ".agents/skills/teleo-infra-provenance/SKILL.md",
+    "docs/reports/leo-working-state-20260709/current-truth-index.md",
+    "docs/reports/leo-working-state-20260709/operator-surface-map.md",
+    "docs/reports/leo-working-state-20260709/gcp-db-first-working-leo-20260714.md",
+    "docs/reports/leo-working-state-20260709/working-leo-definition-20260709.md",
+    "docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.md"
+  ],
+  "cleanup_readback": {
+    "temporary_skill_root_removed": true,
+    "matching_temporary_roots_remaining": 0,
+    "orphan_processes_started": false
+  },
+  "external_runtime_contacted": false,
+  "production_mutation": false,
+  "contains_secrets": false,
+  "problems": [],
+  "strongest_claim_allowed": "T2 fresh-context local onboarding and route validation only; this does not prove live VPS, GCP promotion, Telegram delivery, or production proposal application"
+}

docs/reports/leo-working-state-20260709/skill-pack-clean-context-canary-current.json

@@ -0,0 +1,71 @@
+{
+  "agent_reasoning_exercised": false,
+  "ambient_skill_root_used": false,
+  "artifact": "leo_teleo_skill_pack_isolated_install_canary",
+  "canary_command": ".agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .",
+  "canary_exit_status": 0,
+  "canary_receipt": {
+    "artifact": "leo_teleo_skill_pack_path_validation",
+    "checked_path_count": 234,
+    "checked_paths_sha256": "19ed1813f9cb4c19489a180081007842e241a2dcae659a5d873582fbbd50cff6",
+    "contains_secrets": false,
+    "coverage_area_count": 13,
+    "manifest": "docs/reports/leo-working-state-20260709/skill-pack-manifest.json",
+    "problems": [],
+    "production_mutation_authorized": false,
+    "required_tier": "T2_runtime",
+    "skill_count": 16,
+    "status": "pass"
+  },
+  "cleanup_readback": {
+    "orphan_processes_started": false,
+    "temporary_skill_root_removed": true
+  },
+  "contains_secrets": false,
+  "current_tier": "T2_runtime",
+  "evidence_paths": {
+    "authority": ".agents/skills/teleo-infra-provenance/SKILL.md",
+    "candidate_only_gcp": ".agents/skills/teleo-reconstruction-recovery/SKILL.md",
+    "gcp_database": ".agents/skills/teleo-leo-onboarding/SKILL.md",
+    "live_service": ".agents/skills/teleo-infra-provenance/SKILL.md",
+    "merged_reasoning_verifier": ".agents/skills/teleo-reconstruction-recovery/SKILL.md",
+    "merged_reconstruction": ".agents/skills/teleo-reconstruction-recovery/SKILL.md",
+    "next_safe_action": ".agents/skills/teleo-leo-onboarding/SKILL.md",
+    "vps_database": ".agents/skills/teleo-leo-onboarding/SKILL.md"
+  },
+  "expected_answers": {
+    "authority": "GitHub living-ip/teleo-infrastructure",
+    "candidate_only_gcp": "PR #148 open candidate only; not canonical main",
+    "gcp_database": "private Cloud SQL teleo_canonical; persistent copy remains staging",
+    "live_service": "leoclean-gateway.service",
+    "merged_reasoning_verifier": "PR #147 merged unseen-reasoning verifier hardening",
+    "merged_reconstruction": "PR #146 merged deterministic genesis-plus-ledger reconstruction",
+    "next_safe_action": "run the repo-local path validator before any operational action",
+    "vps_database": "teleo-pg / teleo"
+  },
+  "external_runtime_contacted": false,
+  "fresh_temporary_skill_root": true,
+  "installed_skill_count": 16,
+  "missing_to_reach_required_tier": [],
+  "problems": [],
+  "production_mutation_authorized": false,
+  "proof_scope": "deterministic_isolated_install_and_route_validation",
+  "required_tier": "T2_runtime",
+  "selected_installed_skills": [
+    "teleo-infra-provenance",
+    "teleo-leo-onboarding",
+    "teleo-reconstruction-recovery"
+  ],
+  "semantic_checks": {
+    "authority": true,
+    "candidate_only_gcp": true,
+    "gcp_database": true,
+    "live_service": true,
+    "merged_reasoning_verifier": true,
+    "merged_reconstruction": true,
+    "next_safe_action": true,
+    "vps_database": true
+  },
+  "status": "pass",
+  "strongest_claim_allowed": "T2 deterministic isolated local skill install, route-contract, and path validation only; this artifact does not claim an agent reasoning run, and retained product proofs keep their own VPS, GCP-staging, isolated-clone, Telegram, and production claim ceilings"
+}

docs/reports/leo-working-state-20260709/skill-pack-manifest.json

@@ -1,39 +1,51 @@
 {
   "pack": "leo-teleo-skill-pack",
   "created_date": "2026-07-09",
-  "last_updated_utc": "2026-07-13T06:45:00Z",
+  "last_updated_utc": "2026-07-15T00:16:53Z",
-  "status": "repo_native_validated",
+  "status": "repo_native_path_validated",
   "contains_secrets": false,
   "production_mutation_authorized": false,
   "repo_skill_root": ".agents/skills",
   "optional_local_install_target": "/Users/user/.codex/skills",
-  "claim_ceiling": "Repo-native onboarding and operations skills. Generic and Helmer guarded-apply canaries pass 37/37 in disposable PostgreSQL. PR #72 source auto-synchronized to the VPS checkout without a gateway restart or profile-source delta; the permission migration was not applied, the apply worker remained disabled/inactive, and Helmer remained unapplied. Current source-composition/apply lifecycle proof is stronger and remains isolated. GCP gateway and exact canonical DB parity are proven across 39 tables and 52,164 rows, and the hardened adapter-free model replay passes 6/6 with exact count consistency. Durable GCP operator identity and retained clone cleanup remain open. Broad blind VPS reasoning is not reliable yet: independent strict judges accepted only 1/12 and 2/12 outright. Current skills require exact m3taversal naming, neutral follow-up labels, and current-v1 schema truth.",
+  "claim_ceiling": "Repo-native onboarding and operations skills at T2 clean-context local runtime. PRs #146 and #147 are merged and own deterministic reconstruction plus unseen-reasoning verification. PR #148 is open candidate evidence only. Generic and Helmer guarded-apply canaries pass 37/37 in disposable PostgreSQL, while production rich packets remain unapplied. The latest disposable GCP clone matched 39 tables and 52,167 rows and a no-send model turn passed 18/18 runtime checks plus 6/6 reasoning outcomes; persistent GCP teleo_canonical remains staging and no promotion, production apply, or current Telegram-visible end-to-end proof is claimed.",
+  "repository_reconciliation": {
+    "merged_pull_requests": [146, 147],
+    "candidate_only_pull_requests": [148],
+    "canonical_reconstruction_contract": "docs/kb-rebuild-and-recompile.md",
+    "canonical_turn_manifest": "scripts/leo_turn_execution_manifest.py",
+    "canonical_unseen_reasoning_verifier": "scripts/verify_leo_unseen_reasoning_chain.py"
+  },
   "skills": [
     {
       "name": "teleo-leo-onboarding",
-      "role": "Company/product/architecture orientation for Leo and Teleo work",
+      "role": "Company, product, architecture, task routing, and clean-context entry point",
       "path": ".agents/skills/teleo-leo-onboarding/SKILL.md"
     },
     {
       "name": "working-leo-m3taversal-outcomes",
-      "role": "Definition of working Leo from m3taversal outcomes and tests",
+      "role": "Definition of working Leo, identity discipline, behavior, and proof ceiling",
       "path": ".agents/skills/working-leo-m3taversal-outcomes/SKILL.md"
     },
     {
       "name": "teleo-vps-runtime-ops",
-      "role": "VPS runtime navigation, service health, Docker/Postgres checks, report sync",
+      "role": "VPS runtime navigation, incidents, service health, Postgres, and cleanup",
       "path": ".agents/skills/teleo-vps-runtime-ops/SKILL.md"
     },
     {
       "name": "teleo-gcp-parity-ops",
-      "role": "GCP operator access, private Cloud SQL parity, m3taversal replay, rollback, and cleanup",
+      "role": "GCP access, private Cloud SQL parity, no-send replay, rollback, and cleanup",
       "path": ".agents/skills/teleo-gcp-parity-ops/SKILL.md"
     },
     {
       "name": "teleo-kb-db-change-workflow",
-      "role": "Strict proposal normalization, separated review/apply authority, isolated canary, and row-level proof",
+      "role": "Source ingestion, proposal normalization, review, guarded apply, and receipts",
       "path": ".agents/skills/teleo-kb-db-change-workflow/SKILL.md"
     },
+    {
+      "name": "teleo-reconstruction-recovery",
+      "role": "Snapshot recovery, genesis-ledger replay, source recompilation, and incident recovery",
+      "path": ".agents/skills/teleo-reconstruction-recovery/SKILL.md"
+    },
     {
       "name": "leo-telegram-canary-ops",
       "role": "Live Telegram bot testing through authenticated Chrome and Computer Use",
@@ -41,29 +53,121 @@
     },
     {
       "name": "teleo-infra-provenance",
-      "role": "Repo/deploy/runtime provenance and path confusion prevention",
+      "role": "Repository, deploy, runtime, database, and retained-proof provenance",
       "path": ".agents/skills/teleo-infra-provenance/SKILL.md"
     },
     {
       "name": "teleo-proof-handoff",
-      "role": "Evidence-indexed handoff format for Fable/Codex/Opus workers",
+      "role": "Capability tiers, retained evidence, cleanup, and worker handoff",
       "path": ".agents/skills/teleo-proof-handoff/SKILL.md"
+    },
+    {
+      "name": "nousresearch-hermes-agent",
+      "role": "Hermes agent packaging, skills, prompts, memory, model routing, and no-secret policy",
+      "path": ".agents/skills/nousresearch-hermes-agent/SKILL.md"
+    },
+    {
+      "name": "teleo-db-operator",
+      "role": "Read-first Teleo pipeline SQLite discovery, audit, backup, and guarded writes",
+      "path": ".agents/skills/teleo-db-operator/SKILL.md"
+    },
+    {
+      "name": "private-password-storage",
+      "role": "Device-local credential presence and secure-input handling without chat disclosure",
+      "path": ".agents/skills/private-password-storage/SKILL.md"
+    },
+    {
+      "name": "crabbox",
+      "role": "Isolated remote Linux and CI proof without production deployment",
+      "path": ".agents/skills/crabbox/SKILL.md"
+    },
+    {
+      "name": "decision-engine-refinement",
+      "role": "Replayable model, evaluator, rubric, and decision-engine quality work",
+      "path": ".agents/skills/decision-engine-refinement/SKILL.md"
+    },
+    {
+      "name": "living-ip-kb-interop",
+      "role": "Safe external-agent knowledge read and propose-first writeback contracts",
+      "path": ".agents/skills/living-ip-kb-interop/SKILL.md"
+    },
+    {
+      "name": "openclaw-agent",
+      "role": "No-secret Living IP agent packaging for OpenClaw workspaces",
+      "path": ".agents/skills/openclaw-agent/SKILL.md"
     }
   ],
+  "required_coverage": {
+    "company_product_context": ["teleo-leo-onboarding"],
+    "vps": ["teleo-vps-runtime-ops"],
+    "gcp": ["teleo-gcp-parity-ops"],
+    "hermes_runtime": ["nousresearch-hermes-agent", "teleo-vps-runtime-ops"],
+    "database_provenance": ["teleo-infra-provenance", "teleo-db-operator"],
+    "ingestion": ["teleo-kb-db-change-workflow", "living-ip-kb-interop"],
+    "proposal_apply": ["teleo-kb-db-change-workflow"],
+    "reconstruction": ["teleo-reconstruction-recovery"],
+    "identity": ["teleo-leo-onboarding", "working-leo-m3taversal-outcomes"],
+    "testing": ["teleo-leo-onboarding", "teleo-proof-handoff", "crabbox", "decision-engine-refinement"],
+    "security": ["teleo-vps-runtime-ops", "teleo-gcp-parity-ops", "private-password-storage"],
+    "secrets": ["private-password-storage"],
+    "incident_recovery": ["teleo-reconstruction-recovery", "teleo-vps-runtime-ops"]
+  },
   "reference_files": [
+    "docs/reports/leo-working-state-20260709/skill-pack-clean-context-agent-review-current.json",
+    "docs/reports/leo-working-state-20260709/skill-pack-clean-context-canary-current.json",
     "docs/reports/leo-working-state-20260709/current-truth-index.md",
     "docs/reports/leo-working-state-20260709/operator-surface-map.md",
     "docs/reports/leo-working-state-20260709/fable-leo-teleo-onboarding.md",
+    "docs/reports/leo-working-state-20260709/gcp-db-first-working-leo-20260714.md",
+    "docs/reports/leo-working-state-20260709/gcp-db-first-parity-current.json",
+    "docs/reports/leo-working-state-20260709/gcp-db-first-blind-claim-current.json",
+    "docs/reports/leo-working-state-20260709/gcp-db-first-cleanup-current.json",
+    "docs/reports/leo-working-state-20260709/gcp-db-first-live-deploy-restart-current.json",
     "docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.md",
-    "docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.md",
-    "docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.md",
-    "docs/reports/leo-working-state-20260709/pr72-vps-auto-deploy-runtime-nonchange-current.md",
-    "docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.md",
-    "docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json",
-    "docs/reports/leo-working-state-20260709/gcp-operator-access-blocker-current.json",
-    "docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-dc01-partial-current.json",
     "docs/reports/leo-working-state-20260709/working-leo-current-proof-20260712.md",
-    "docs/reports/leo-working-state-20260709/working-leo-current-proof-20260712.json"
+    "docs/reports/leo-working-state-20260709/leo-unified-turn-manifest-canary-current.json",
+    "docs/reports/leo-working-state-20260709/leo-architecture-work-and-outcomes-20260714.md",
+    "docs/kb-rebuild-and-recompile.md"
   ],
-  "validation": "tests/test_repo_skill_pack.py"
+  "command_files": [
+    ".agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py",
+    ".agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py",
+    ".agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py",
+    "ops/run_local_canonical_postgres_rebuild.py",
+    "ops/run_local_genesis_ledger_rebuild.py",
+    "ops/capture_vps_canonical_postgres_snapshot.py",
+    "ops/restore_gcp_generated_postgres_snapshot.py",
+    "ops/verify_postgres_parity_manifest.py",
+    "scripts/compile_kb_source_packet.py",
+    "scripts/approve_proposal.py",
+    "scripts/apply_proposal.py",
+    "scripts/leo_turn_execution_manifest.py",
+    "scripts/verify_leo_unseen_reasoning_chain.py",
+    "tests/test_repo_skill_pack.py"
+  ],
+  "scan_files": [
+    "docs/reports/leo-working-state-20260709/skill-pack-readme.md",
+    "docs/reports/leo-working-state-20260709/current-truth-index.md",
+    "docs/reports/leo-working-state-20260709/operator-surface-map.md",
+    "docs/reports/leo-working-state-20260709/fable-leo-teleo-onboarding.md",
+    "docs/reports/leo-working-state-20260709/leo-architecture-work-and-outcomes-20260714.md",
+    "README.md",
+    "docs/kb-rebuild-and-recompile.md"
+  ],
+  "executable_files": [
+    ".agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py",
+    ".agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py",
+    ".agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py",
+    ".agents/skills/private-password-storage/scripts/private-password-storage"
+  ],
+  "validator": ".agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py",
+  "installer": ".agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py",
+  "isolated_install_canary": ".agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py",
+  "fresh_agent_receipt": "docs/reports/leo-working-state-20260709/skill-pack-clean-context-agent-review-current.json",
+  "validation": "tests/test_repo_skill_pack.py",
+  "validation_commands": [
+    ".agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .",
+    ".agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py --root .",
+    ".venv/bin/python -m pytest -q tests/test_repo_skill_pack.py"
+  ]
 }

docs/reports/leo-working-state-20260709/skill-pack-readme.md

@@ -1,42 +1,91 @@
-# Leo / Teleo Skill Pack - 2026-07-09
+# Leo / Teleo Skill Pack - 2026-07-15
 
-Purpose: reusable onboarding and operating knowledge for future Codex/Fable workers working on Leo, Teleo, the VPS, GCP parity, Telegram canaries, and KB database changes.
+Purpose: give a new engineer or agent one repo-native route into Leo/Teleo
+architecture, operations, database lifecycle, proof tiers, secrets, and recovery
+without relying on historical chat or unmerged branch prose.
 
-This is the repo-native skill set under `.agents/skills/`. It is evidence-linked and validated by `tests/test_repo_skill_pack.py`. It does not contain secrets, private key contents, bot tokens, or production mutation authorization.
+The pack lives under `.agents/skills/`, contains no credentials, and grants no
+production database mutation or GCP promotion authority.
+
+## Clean-Context Entry Point
+
+From the repository root:
+
+```bash
+.agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .
+.agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py \
+  --root . \
+  --target /private/tmp/teleo-clean-agent/skills
+.agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py --root .
+```
+
+The validator uses standard-library Python through its executable shebang. For
+pytest, create the repository virtual environment from `README.md` and use
+`.venv/bin/python`; do not assume a bare `python` executable exists.
 
 ## Skills In This Pack
 
-1. `teleo-leo-onboarding`: company/product/architecture orientation before touching Leo or Teleo.
+1. `teleo-leo-onboarding`: product, architecture, task router, and first canary.
-2. `working-leo-m3taversal-outcomes`: m3taversal's expected Leo behavior and the current benchmark.
+2. `working-leo-m3taversal-outcomes`: exact identity discipline and working-Leo proof ceiling.
-3. `teleo-vps-runtime-ops`: VPS service, paths, Postgres, Docker, report sync, and stability checks.
+3. `teleo-vps-runtime-ops`: VPS services, Postgres, incidents, and cleanup.
-4. `teleo-gcp-parity-ops`: passwordless GCP access, Cloud SQL parity, no-send replay, rollback, and cleanup.
+4. `teleo-gcp-parity-ops`: GCP/Cloud SQL parity, no-send replay, and rollback.
-5. `teleo-kb-db-change-workflow`: source composition plus approved proposal to canonical-row workflow with clone rehearsal and rollback.
+5. `teleo-kb-db-change-workflow`: source ingestion through guarded proposal/apply.
-6. `leo-telegram-canary-ops`: live Telegram/Chrome/Computer Use canaries for Leo bot behavior.
+6. `teleo-reconstruction-recovery`: snapshot, ledger, and semantic recovery modes.
-7. `teleo-infra-provenance`: repo, deploy, mirror, and runtime provenance map.
+7. `leo-telegram-canary-ops`: authorized Leo-specific Telegram canaries.
-8. `teleo-proof-handoff`: evidence bundle and Fable/Codex worker handoff protocol.
+8. `teleo-infra-provenance`: repository, deploy, runtime, DB, and proof provenance.
+9. `teleo-proof-handoff`: tiered evidence and continuation handoffs.
+10. `nousresearch-hermes-agent`: Hermes packaging and runtime boundaries.
+11. `teleo-db-operator`: read-first pipeline SQLite operation.
+12. `private-password-storage`: device-local secure input and presence checks.
+13. `crabbox`: isolated remote Linux and CI proof.
+14. `decision-engine-refinement`: replayable evaluator and model-quality work.
+15. `living-ip-kb-interop`: propose-first external-agent KB access.
+16. `openclaw-agent`: no-secret OpenClaw workspace packaging.
+
+The machine-readable topic coverage and exact paths are in
+`docs/reports/leo-working-state-20260709/skill-pack-manifest.json`.
+
+## Repository Reconciliation
+
+- PR #146 is merged: deterministic turn manifests and the first exact
+  genesis-plus-ledger reconstruction slice are canonical `main` behavior.
+- PR #147 is merged: the unseen-reasoning verifier accepts valid reasoning
+  variance while keeping evidence and receipt gates.
+- PR #148 is open candidate evidence only. Its proposed least-privilege GCP
+  files and live end state are not canonical until merged and receipt-verified.
 
 ## Current Claim Ceiling
 
-- VPS Leo Telegram memory, KB audit, and staged write canaries are live-proven.
+- T2 clean-context local skill install, route validation, and focused tests are
-- A strict canonical `add_edge` apply canary is live-proven.
+  the onboarding target for this pack.
-- Deterministic source composition, full-data clone composition/reasoning, and guarded approved-bundle application are isolated-proven with exact source/evidence/claim links, row deltas, rollback, and cleanup. Production rich packets remain unapplied.
+- VPS no-send behavior, isolated proposal/apply, snapshot recovery, disposable
-- Narrow VPS DB truth and restart behavior are proven. Broad blind reasoning is not yet reliable; exact participant naming, neutral labels, and current-v1 schema guards are now required.
+  GCP parity, and bounded no-send GCP reasoning have retained evidence.
-- GCP gateway liveness, private Cloud SQL identity, exact VPS-to-GCP canonical parity, and hardened adapter-free model replay are live-proven. The database matches across `39` tables and `52,164` rows. Durable operator identity and retained replay-clone cleanup remain open because the intended target service accounts are absent.
+- Persistent GCP `teleo_canonical` remains staging. No GCP promotion or cutover
+  is authorized or claimed.
+- Production rich packets remain unapplied. A current Telegram-visible complete
+  flow is not proven by this pack.
 
 ## Key References
 
-- Current whole-system proof: `docs/reports/leo-working-state-20260709/working-leo-current-proof-20260712.md` and `.json`
+- Fresh-agent onboarding receipt: `docs/reports/leo-working-state-20260709/skill-pack-clean-context-agent-review-current.json`
-- Current truth index: `docs/reports/leo-working-state-20260709/current-truth-index.md`
+- Isolated-install acceptance receipt: `docs/reports/leo-working-state-20260709/skill-pack-clean-context-canary-current.json`
-- Operator surface map: `docs/reports/leo-working-state-20260709/operator-surface-map.md`
+- Current truth: `docs/reports/leo-working-state-20260709/current-truth-index.md`
-- Fable onboarding prompt: `docs/reports/leo-working-state-20260709/fable-leo-teleo-onboarding.md`
+- Architecture/outcomes: `docs/reports/leo-working-state-20260709/leo-architecture-work-and-outcomes-20260714.md`
-- PR #72 VPS auto-deploy/runtime readback: `docs/reports/leo-working-state-20260709/pr72-vps-auto-deploy-runtime-nonchange-current.md`
+- Recovery contract: `docs/kb-rebuild-and-recompile.md`
-- GCP canonical parity: `docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json`
+- GCP database-first proof: `docs/reports/leo-working-state-20260709/gcp-db-first-working-leo-20260714.md`
-- GCP model replay (legacy artifact filename): `docs/reports/leo-working-state-20260709/gcp-cory-model-replay-current.json`
+- GCP no-send reasoning receipt: `docs/reports/leo-working-state-20260709/gcp-db-first-blind-claim-current.json`
-- Three-day delivery delta: `docs/reports/leo-working-state-20260709/working-leo-three-day-delivery-summary-20260713.md`
+- Unified turn receipt: `docs/reports/leo-working-state-20260709/leo-unified-turn-manifest-canary-current.json`
-- Blind out-of-sample audit: `docs/reports/leo-working-state-20260709/telegram-handler-blind-oos-audit-current.json`
+- Operator map: `docs/reports/leo-working-state-20260709/operator-surface-map.md`
-- GCP operator access gate: `docs/reports/leo-working-state-20260709/gcp-operator-access-blocker-current.json`
-- Skill manifest: `skill-pack-manifest.json`
 
-## Discovery
+## Team Change Notes
 
-Codex-compatible workers should discover the committed `.agents/skills/` tree from this repository. The manifest is the index; each skill points to current retained evidence rather than embedding secrets or pretending a stale snapshot is live truth.
+- Replaced the missing legacy GCP replay route with the current database-first
+  no-send receipt.
+- Added deterministic install and path-validation commands.
+- Added separate T2 receipts for deterministic isolated install/path validation
+  and fresh-context agent reasoning, stale-claim rejection, and cleanup.
+- Added an explicit topic router and recovery skill.
+- Added merged-vs-open PR boundaries so branch candidates cannot silently become
+  source-of-truth instructions.
+- Added tests for coverage, route existence, installer behavior, and exact
+  m3taversal identity prose.

tests/test_repo_skill_pack.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import json
+import re
+import subprocess
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
@@ -15,12 +17,12 @@ def _skill(name: str) -> str:
 def test_manifest_indexes_valid_repo_native_skills() -> None:
     manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
 
-    assert manifest["status"] == "repo_native_validated"
+    assert manifest["status"] == "repo_native_path_validated"
     assert manifest["repo_skill_root"] == ".agents/skills"
     assert manifest["validation"] == "tests/test_repo_skill_pack.py"
     assert "37/37" in manifest["claim_ceiling"]
-    assert "auto-synchronized" in manifest["claim_ceiling"]
+    assert "PRs #146 and #147 are merged" in manifest["claim_ceiling"]
-    assert "apply worker remained disabled/inactive" in manifest["claim_ceiling"]
+    assert "PR #148 is open candidate evidence only" in manifest["claim_ceiling"]
 
     for entry in manifest["skills"]:
         path = ROOT / entry["path"]
@@ -34,6 +36,139 @@ def test_manifest_indexes_valid_repo_native_skills() -> None:
         assert (ROOT / relative).is_file(), relative
 
 
+def test_manifest_covers_the_required_onboarding_surface() -> None:
+    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
+    expected = {
+        "company_product_context",
+        "vps",
+        "gcp",
+        "hermes_runtime",
+        "database_provenance",
+        "ingestion",
+        "proposal_apply",
+        "reconstruction",
+        "identity",
+        "testing",
+        "security",
+        "secrets",
+        "incident_recovery",
+    }
+    assert set(manifest["required_coverage"]) == expected
+    skill_names = {entry["name"] for entry in manifest["skills"]}
+    repo_skill_names = {path.parent.name for path in (ROOT / ".agents" / "skills").glob("*/SKILL.md")}
+    assert skill_names == repo_skill_names
+    for owners in manifest["required_coverage"].values():
+        assert owners
+        assert set(owners) <= skill_names
+
+
+def test_path_validator_and_clean_installer() -> None:
+    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
+    validator = ROOT / manifest["validator"]
+    result = subprocess.run(
+        [str(validator), "--root", str(ROOT)],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    payload = json.loads(result.stdout)
+    assert payload["status"] == "pass"
+    assert payload["skill_count"] == len(manifest["skills"])
+    assert payload["coverage_area_count"] == len(manifest["required_coverage"])
+    assert payload["problems"] == []
+
+
+def test_installer_copies_only_manifest_skills(tmp_path: Path) -> None:
+    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
+    installer = ROOT / manifest["installer"]
+    target = tmp_path / "skills"
+    result = subprocess.run(
+        [str(installer), "--root", str(ROOT), "--target", str(target)],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    payload = json.loads(result.stdout)
+    assert payload["status"] == "pass"
+    assert payload["installed_skill_count"] == len(manifest["skills"])
+    assert {path.name for path in target.iterdir()} == {entry["name"] for entry in manifest["skills"]}
+    assert all((target / entry["name"] / "SKILL.md").is_file() for entry in manifest["skills"])
+
+
+def test_installer_rejects_manifest_path_traversal(tmp_path: Path) -> None:
+    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
+    manifest["skills"][0]["name"] = "../escape"
+    malicious_manifest = tmp_path / "manifest.json"
+    malicious_manifest.write_text(json.dumps(manifest), encoding="utf-8")
+    target = tmp_path / "target" / "skills"
+
+    result = subprocess.run(
+        [
+            str(ROOT / manifest["installer"]),
+            "--root",
+            str(ROOT),
+            "--manifest",
+            str(malicious_manifest),
+            "--target",
+            str(target),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.returncode == 1
+    assert "invalid skill name" in result.stdout
+    assert not (tmp_path / "target" / "escape").exists()
+    assert not target.exists()
+
+
+def test_isolated_install_canary_reaches_t2_without_claiming_agent_reasoning(tmp_path: Path) -> None:
+    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
+    canary = ROOT / manifest["isolated_install_canary"]
+    output = tmp_path / "receipt.json"
+    result = subprocess.run(
+        [str(canary), "--root", str(ROOT), "--output", str(output)],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    payload = json.loads(output.read_text(encoding="utf-8"))
+    assert payload["status"] == "pass"
+    assert payload["required_tier"] == "T2_runtime"
+    assert payload["current_tier"] == "T2_runtime"
+    assert payload["proof_scope"] == "deterministic_isolated_install_and_route_validation"
+    assert payload["fresh_temporary_skill_root"] is True
+    assert payload["ambient_skill_root_used"] is False
+    assert payload["agent_reasoning_exercised"] is False
+    assert payload["installed_skill_count"] == len(manifest["skills"])
+    assert all(payload["semantic_checks"].values())
+    assert payload["canary_exit_status"] == 0
+    assert payload["cleanup_readback"]["temporary_skill_root_removed"] is True
+    assert payload["missing_to_reach_required_tier"] == []
+
+
+def test_fresh_agent_receipt_rejects_stale_routes() -> None:
+    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
+    receipt = json.loads((ROOT / manifest["fresh_agent_receipt"]).read_text(encoding="utf-8"))
+
+    assert receipt["status"] == "pass"
+    assert receipt["evidence_origin"]["fork_turns"] == "none"
+    assert receipt["evidence_origin"]["memory_used"] is False
+    assert all(receipt["stale_claims_rejected"].values())
+    assert receipt["validator"]["status"] == "pass"
+    assert receipt["validator"]["skill_count"] == 16
+    assert receipt["repository_readback"]["unchanged"] is True
+    assert receipt["cleanup_readback"]["temporary_skill_root_removed"] is True
+    assert receipt["external_runtime_contacted"] is False
+    assert receipt["production_mutation"] is False
+    assert receipt["contains_secrets"] is False
+    assert receipt["problems"] == []
+
+
 def test_db_change_skill_tracks_guarded_v2_runtime_proof() -> None:
     text = _skill("teleo-kb-db-change-workflow")
     squashed = " ".join(text.split())
@@ -120,3 +255,31 @@ def test_vps_onboarding_and_m3taversal_skills_point_to_current_proof() -> None:
     assert "Next proof-changing follow-up:" in outcomes
     assert "working-leo-current-proof-20260712.md" in outcomes
     assert "Cory" not in outcomes
+
+
+def test_reconstruction_and_pr_state_are_routed_without_candidate_overclaim() -> None:
+    reconstruction = _skill("teleo-reconstruction-recovery")
+    onboarding = _skill("teleo-leo-onboarding")
+    gcp = _skill("teleo-gcp-parity-ops")
+    current_truth = (REPORT_DIR / "current-truth-index.md").read_text(encoding="utf-8")
+
+    assert "ops/run_local_genesis_ledger_rebuild.py" in reconstruction
+    assert "scripts/verify_leo_unseen_reasoning_chain.py" in reconstruction
+    assert "Semantic source-to-blank-database recompilation remains incomplete" in reconstruction
+    assert "PRs #146 and #147 are merged repository truth" in onboarding
+    assert "PR #148 remains an open GCP" in onboarding
+    assert "candidate evidence only" in gcp
+    assert "PRs #146 and #147 are merged into canonical `main`" in current_truth
+    assert "PR #148 remains open candidate evidence" in current_truth
+
+
+def test_active_onboarding_prose_uses_exact_m3taversal_identity() -> None:
+    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
+    active_files = [
+        *[ROOT / relative for relative in manifest["scan_files"]],
+        *[ROOT / entry["path"] for entry in manifest["skills"]],
+    ]
+    for path in active_files:
+        text = path.read_text(encoding="utf-8")
+        prose = re.sub(r"`[^`]*\/[^`]+\.(?:md|json|svg)`", "", text)
+        assert re.search(r"\bcory(?:-style)?\b", prose, flags=re.IGNORECASE) is None, path